WordPress Plugin Vulnerabilities

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

Description

The plugin does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

Proof of Concept

Affects Plugins

Plugin icon
motopress-hotel-booking-lite
Fixed in 6.2.3

References

CVE
CVE-2026-15237

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Haitam Lazaar
Submitter
Haitam Lazaar
Submitter website
https://www.linkedin.com/in/haitam-lazaar/
Verified
Yes
WPVDB ID
b312a323-808c-497f-b67e-3b0acfcb8932

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2025-12-11
Title
Product Filtering by Categories, Tags, Price Range for WooCommerce < 1.1.7 - Missing Authorization to Unauthenticated Plugin Settings Modification
Published
2023-12-27
Title
WebinarIgnition < 3.05.1 - Missing Authorization to Unauthenticated Privilege Escalation
Published
2025-03-03
Title
VW Storefront < 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
Published
2025-09-30
Title
Ultimate Learning Pro <= 3.9.3 - Authenticated (Instructor+) Arbitrary Content Deletion
Published
2025-03-31
Title
Sliced Invoices <= 3.10.0 - Missing Authorization